@lunora/advisor 1.0.0-alpha.34 → 1.0.0-alpha.35

package/dist/packem_shared/privilegedDispatchUnvalidatedPayload-5Forjckt.mjs

@@ -1,37 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const privilegedDispatchUnvalidatedPayload = {
-  categories: ["SECURITY"],
-  description: "A `defineQueue`/`defineWorkflow` handler forwards its untrusted payload (queue body / workflow params) straight into a `ctx.run` dispatch whose target is RLS-gated. The handler runs under the system identity with RLS disabled, so the target's row policy — the only thing guarding it — is bypassed, letting a caller act as any user / write across tenants.",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  name: "privileged_dispatch_unvalidated_payload",
-  remediation: "Don't forward an unchecked queue body / workflow param into an RLS-gated function. Re-derive the ownership/identity keys from server-trusted state (or an argument you validate against it) before dispatching, or route the work through a function that re-checks the caller's identity rather than relying on the row policy the privileged handler skips.",
-  run: (context) => {
-    if (context.privilegedDispatches === void 0) {
-      return [];
-    }
-    const rlsProcedures = context.rlsProcedures ?? [];
-    const targetUsesRls = (targetFile, targetExport) => rlsProcedures.some((procedure) => procedure.usesRls && procedure.file === targetFile && procedure.exportName === targetExport);
-    return context.privilegedDispatches.filter((dispatch) => targetUsesRls(dispatch.targetFile, dispatch.targetExport)).map((dispatch) => {
-      const handlerKind = dispatch.dispatchKind === "queue" ? "queue" : "workflow";
-      const payloadSource = dispatch.dispatchKind === "queue" ? "queue message body" : "workflow params";
-      return emit(privilegedDispatchUnvalidatedPayload, {
-        cacheKey: `privileged_dispatch_unvalidated_payload:${dispatch.file}:${dispatch.line.toString()}`,
-        detail: `The ${handlerKind} handler \`${dispatch.handlerExport}\` (${dispatch.file}:${dispatch.line.toString()}) forwards its untrusted ${payloadSource} straight into \`${dispatch.targetFile}.${dispatch.targetExport}\`, which is guarded by \`.use(rls(...))\`. The handler runs under the system identity with RLS disabled, so the target's row policy is bypassed — any ownership/identity field the payload controls lets a caller act as another user or write across tenants. Re-derive the identity keys from server-trusted state before dispatching, or route through a function that re-checks the caller.`,
-        metadata: {
-          dispatchKind: dispatch.dispatchKind,
-          file: dispatch.file,
-          handlerExport: dispatch.handlerExport,
-          line: dispatch.line,
-          targetExport: dispatch.targetExport,
-          targetFile: dispatch.targetFile
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Privileged handler forwards untrusted payload into an RLS-gated function"
-};
-
-export { privilegedDispatchUnvalidatedPayload as default };

package/dist/packem_shared/privilegedFanoutFromPublicProcedure-D3dL01B8.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const privilegedFanoutFromPublicProcedure = {
-  categories: ["SECURITY"],
-  description: "A public procedure fans work out to a privileged dispatch surface (`ctx.scheduler.runAfter`/`runAt`, a `ctx.queues.<name>` send, or `ctx.workflows.<name>.create`) with no rate-limit guard. Each dispatch runs later under the system identity and bills the account, so an anonymous caller can amplify cost and flood the async surface in a loop.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "privileged_fanout_from_public_procedure",
-  remediation: "Gate the public entry point with a rate limit (`.use(rateLimit(...))` or a `protectPublic({ rateLimit })` bundle), or make the fan-out procedure internal and trigger it only from an authenticated, guarded path. Never expose an unbounded scheduler/queue/workflow dispatch to anonymous callers.",
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    return context.procedureProtections.filter((procedure) => procedure.fanOut && procedure.visibility === "public" && !procedure.usesRateLimit).map(
-      (procedure) => emit(privilegedFanoutFromPublicProcedure, {
-        cacheKey: `privileged_fanout_from_public_procedure:${procedure.file}:${procedure.exportName}`,
-        detail: `\`${procedure.exportName}\` (${procedure.file}) is public and fans work out to a privileged dispatch surface (scheduler/queue/workflow) with no rate limit — an anonymous caller can drive that billable, system-identity dispatch in a loop. Add a rate-limit guard, or make it internal and trigger it from an authenticated path.`,
-        metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind }
-      })
-    );
-  },
-  source: "static",
-  title: "Public procedure fans out to a privileged dispatch surface"
-};
-
-export { privilegedFanoutFromPublicProcedure as default };

package/dist/packem_shared/publicArgumentUsesAny-C71b2NCf.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const publicArgumentUsesAny = {
-  categories: ["SECURITY"],
-  description: "A public procedure declares a `v.any()` argument. `v.any()` accepts arbitrary untyped input from an untrusted client — defeating validation and opening injection / oversized-payload abuse.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "public_arg_uses_any",
-  remediation: "Replace `v.any()` with a precise validator — `v.object({...})`, `v.string()`, `v.union(...)`, etc. If the shape is genuinely dynamic, model the known variants with `v.union` rather than accepting anything.",
-  run: (context) => {
-    if (context.argValidators === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.argValidators) {
-      for (const argument of procedure.anyArgs) {
-        findings.push(
-          emit(publicArgumentUsesAny, {
-            cacheKey: `public_arg_uses_any:${procedure.file}:${procedure.exportName}:${argument}`,
-            detail: `Arg \`${argument}\` of public procedure \`${procedure.exportName}\` (${procedure.file}:${procedure.line.toString()}) is \`v.any()\` — untrusted input with no validation. Give it a precise validator.`,
-            metadata: { argument, exportName: procedure.exportName, file: procedure.file, line: procedure.line }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public argument uses v.any()"
-};
-
-export { publicArgumentUsesAny as default };

package/dist/packem_shared/publicMutationWithoutRatelimit-DbIhgi7j.mjs

@@ -1,36 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { i as isPublicWrite } from './helpers-BySnKhVB.mjs';
-
-const SENSITIVE_NAME_RE = /contact|forgot|login|magic|otp|register|reset|signin|signup|subscribe|verify/iu;
-const publicMutationWithoutRatelimit = {
-  categories: ["SECURITY"],
-  description: "A public `mutation`/`action` has no `rateLimit` middleware. Publicly-callable writes are flood and brute-force targets — an attacker can exhaust writes, mail quota, or credits, or guess credentials on auth-shaped endpoints.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "public_mutation_without_ratelimit",
-  remediation: 'Attach a rate limit: `.use(rateLimit(limiter, "<bucket>"))` from `@lunora/ratelimit`, or wrap the recommended public-procedure guards with `.use(protectPublic({ rateLimit, captcha }))` from `@lunora/server`. Genuinely-open writes can be acknowledged by adding a permissive limiter.',
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.procedureProtections) {
-      if (!isPublicWrite(procedure) || procedure.usesRateLimit) {
-        continue;
-      }
-      const sensitive = SENSITIVE_NAME_RE.test(procedure.exportName);
-      findings.push(
-        emit(publicMutationWithoutRatelimit, {
-          cacheKey: `public_mutation_without_ratelimit:${procedure.file}:${procedure.exportName}`,
-          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) has no rate limit${sensitive ? " — its name suggests an auth/abuse-sensitive endpoint, so this is high-risk" : ""}. Add \`.use(rateLimit(...))\` or \`.use(protectPublic({ rateLimit }))\`.`,
-          metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind, sensitive }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public write without a rate limit"
-};
-
-export { publicMutationWithoutRatelimit as default };

package/dist/packem_shared/publicTableRlsOptoutConfusion-Bn71yoD4.mjs

@@ -1,38 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { o as ownershipOrPiiColumns } from './helpers-BySnKhVB.mjs';
-
-const publicTableRlsOptoutConfusion = {
-  categories: ["SECURITY"],
-  description: '`.public()` opts a table OUT of the schema\'s `.rls("required")` enforcement — it does not mean the table holds public data. A `.public()` table whose columns look ownership- or PII-shaped (`userId`, `email`, `ssn`, …) is exempt from the row-security guard, not "safe to expose".',
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "public_table_rls_optout_confusion",
-  remediation: 'Double-check this table actually needs the RLS opt-out. If it does not, remove `.public()` so `.rls("required")` covers it like every other table. If it genuinely must stay open (a shared lookup table, for instance), rename or comment it so the exemption is intentional rather than a name-implies-safety mistake, and make sure no procedure trusts `.public()` as an authorization boundary.',
-  run: (context) => {
-    if (context.schema.rlsMode !== "required") {
-      return [];
-    }
-    const findings = [];
-    for (const table of context.schema.tables) {
-      if (!table.isPublic) {
-        continue;
-      }
-      const flaggedColumns = ownershipOrPiiColumns(table);
-      if (flaggedColumns.length === 0) {
-        continue;
-      }
-      findings.push(
-        emit(publicTableRlsOptoutConfusion, {
-          cacheKey: `public_table_rls_optout_confusion:${table.name}`,
-          detail: `Table "${table.name}" is \`.public()\` (opted OUT of the schema's \`.rls("required")\` enforcement) but carries ownership/PII-shaped column(s): ${flaggedColumns.join(", ")}. \`.public()\` means "exempt from RLS", not "safe to expose" — confirm this table really needs the opt-out.`,
-          metadata: { columns: flaggedColumns, table: table.name }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public table opts out of RLS but carries sensitive columns"
-};
-
-export { publicTableRlsOptoutConfusion as default };

package/dist/packem_shared/queueWithoutDlq-CSkGNb_0.mjs

@@ -1,41 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const queueWithoutDlq = {
-  categories: ["SCHEMA"],
-  description: "A queue consumer drops a message once it exhausts `maxRetries` (default 3) delivery attempts. Without a `deadLetterQueue`, that message is deleted permanently with no record — route exhausted messages to a DLQ so you can inspect, alert on, and replay them.",
-  facing: "INTERNAL",
-  level: "WARN",
-  name: "queue_without_dlq",
-  remediation: 'Add `deadLetterQueue: "<name>-dlq"` to the `defineQueue({...})` options and declare a consumer for that queue so exhausted messages are inspectable (an unconsumed DLQ still expires at the retention window). `vis generate lunora-queue` with the best-practice setup scaffolds both. If the queue is fire-and-forget and message loss is acceptable, this advisory can be ignored.',
-  run: (context) => {
-    if (context.queues === void 0) {
-      return [];
-    }
-    const dlqTargets = new Set(
-      context.queues.map((queue) => queue.tuning.deadLetterQueue).filter((name) => name !== void 0 && name !== "")
-    );
-    const findings = [];
-    for (const queue of context.queues) {
-      const dlq = queue.tuning.deadLetterQueue;
-      if (dlq !== void 0 && dlq !== "") {
-        continue;
-      }
-      if (dlqTargets.has(queue.name)) {
-        continue;
-      }
-      const maxRetries = typeof queue.tuning.maxRetries === "number" ? queue.tuning.maxRetries : 3;
-      findings.push(
-        emit(queueWithoutDlq, {
-          cacheKey: `queue_without_dlq:${queue.exportName}`,
-          detail: `Queue "${queue.exportName}" declares no \`deadLetterQueue\`, so a message that exhausts its retries (\`maxRetries\` = ${String(maxRetries)}, ~${String(maxRetries + 1)} delivery attempts) is dropped and permanently lost.`,
-          metadata: { maxRetries, mode: queue.mode, queue: queue.exportName }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Queue has no dead-letter queue"
-};
-
-export { queueWithoutDlq as default };

package/dist/packem_shared/r2sqlOutsideAction-CtqxvMuV.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const r2sqlOutsideAction = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler accesses R2 SQL via `ctx.r2sql`. R2 SQL queries external Apache Iceberg tables over REST (no Workers binding): queries are non-deterministic (like `fetch`) and the reads are invisible to live queries. `ctx.r2sql` is available on `ActionCtx` only and must be confined to `action` handlers.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "r2sql_outside_action",
-  remediation: "Move the `ctx.r2sql` access into an `action(...)` (the only context where it is typed), where external I/O is allowed. If a query/mutation needs the data, have the action read it via `ctx.r2sql` and write a projection into a `defineSchema` DO/D1 table — that write is tracked by live queries, whereas R2 SQL is not.",
-  run: (context) => {
-    if (context.r2sqlCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const call of context.r2sqlCalls) {
-      findings.push(
-        emit(r2sqlOutsideAction, {
-          cacheKey: `r2sql_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — R2 SQL's \`ctx.r2sql\` is non-deterministic and non-reactive, so it is available only in actions. Move the external query into an \`action\` and project the result into a Lunora table if a query/mutation needs it.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "R2 SQL `ctx.r2sql` used outside an action"
-};
-
-export { r2sqlOutsideAction as default };

package/dist/packem_shared/ratelimitDefaultMemoryStore-BISChG5C.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const ratelimitDefaultMemoryStore = {
-  categories: ["SECURITY"],
-  description: "`new RateLimiter({...})` has no `store`, so it falls back to a per-instance in-memory store. On Workers each request may hit a different isolate, so the counter never sums across them — the limit silently under-counts and is effectively a no-op under load, giving false protection against brute-force and cost abuse.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "ratelimit_default_memory_store",
-  remediation: "Pass a shared, durable `store` to `new RateLimiter({...})` (a Durable-Object- or KV-backed store) so every Worker isolate reads and writes the same bucket. The default in-memory store is per-isolate and does not enforce a global limit.",
-  run: (context) => {
-    if (context.configCalls === void 0) {
-      return [];
-    }
-    return context.configCalls.filter((call) => call.callee === "RateLimiter" && call.analyzable && !call.presentKeys.includes("store")).map(
-      (call) => emit(ratelimitDefaultMemoryStore, {
-        cacheKey: `ratelimit_default_memory_store:${call.file}:${call.line.toString()}`,
-        detail: `\`new RateLimiter({...})\` in ${call.file}:${call.line.toString()} has no \`store\` — it uses the per-instance in-memory store, which never sums across Worker isolates, so the limit silently under-counts under load. Pass a Durable-Object- or KV-backed \`store\` so the limit is enforced globally.`,
-        metadata: { callee: call.callee, file: call.file, line: call.line }
-      })
-    );
-  },
-  source: "static",
-  title: "RateLimiter using the default in-memory store"
-};
-
-export { ratelimitDefaultMemoryStore as default };

package/dist/packem_shared/ratelimitKeySpoofableOrGlobal-DqlHYQQ3.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const ratelimitKeySpoofableOrGlobal = {
-  categories: ["SECURITY"],
-  description: "A `rateLimit`/`dbRateLimit` middleware call's `key` selector is derived from the handler's `args` with no server-side scoping, so an attacker can rotate the key on every request (e.g. by resubmitting a different email/id) and never share a bucket with themselves — the limit never actually limits them.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "ratelimit_key_spoofable_or_global",
-  remediation: 'Derive the rate-limit `key` from a server-trusted value — `ctx.auth.userId` for authenticated callers, `ctx.ip` for anonymous ones (e.g. `key: (ctx) => ctx.auth.userId ?? ctx.ip ?? "anon"`) — instead of an `args` field the caller controls.',
-  run: (context) => {
-    if (context.ratelimitKeySelectors === void 0) {
-      return [];
-    }
-    return context.ratelimitKeySelectors.map(
-      (selector) => emit(ratelimitKeySpoofableOrGlobal, {
-        cacheKey: `ratelimit_key_spoofable_or_global:${selector.file}:${selector.line.toString()}`,
-        detail: `\`${selector.callee}(…, "${selector.limitName}", { key })\` in \`${selector.exportName}\` (${selector.file}:${selector.line.toString()}) derives its \`key\` from \`args\` with no server-side scoping — an attacker can rotate the key per request and bypass the limit. Derive \`key\` from \`ctx.auth.userId\` / \`ctx.ip\` instead.`,
-        metadata: { callee: selector.callee, exportName: selector.exportName, file: selector.file, limitName: selector.limitName, line: selector.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Rate-limit key derived from spoofable user input"
-};
-
-export { ratelimitKeySpoofableOrGlobal as default };

package/dist/packem_shared/ratelimitMiddlewareFailOpen-CJgDCaUw.mjs

@@ -1,33 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const SENSITIVE_TOKENS = ["signin", "signup", "login", "register", "reset", "password", "otp", "verify", "payment", "checkout"];
-const normalize = (value) => value.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "");
-const matchesSensitiveToken = (value) => {
-  const normalized = normalize(value);
-  return SENSITIVE_TOKENS.some((token) => normalized.includes(token));
-};
-const guardsSensitiveFlow = (row) => matchesSensitiveToken(row.exportName) || matchesSensitiveToken(row.limitName);
-const ratelimitMiddlewareFailOpen = {
-  categories: ["SECURITY"],
-  description: "A rate-limit or Turnstile middleware guarding a sensitive auth/payment procedure is configured `failOpen: true`, so a limiter store outage or a failed Turnstile siteverify silently admits every request — turning a transient failure into an unthrottled brute-force / abuse window.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "ratelimit_middleware_fail_open",
-  remediation: "Drop `failOpen: true` (the default is fail-closed) on the rate-limit / Turnstile guard for auth and payment flows, or move the escape hatch to a non-sensitive procedure. Prefer rejecting traffic with a 503 over admitting unlimited unauthenticated attempts when the limiter or siteverify is unavailable.",
-  run: (context) => {
-    if (context.failOpenGuards === void 0) {
-      return [];
-    }
-    return context.failOpenGuards.filter((row) => row.failOpen && guardsSensitiveFlow(row)).map(
-      (row) => emit(ratelimitMiddlewareFailOpen, {
-        cacheKey: `ratelimit_middleware_fail_open:${row.file}:${row.line.toString()}`,
-        detail: `\`${row.callee}(...)\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) sets \`failOpen: true\` while guarding a sensitive flow — a limiter/siteverify outage then admits every request instead of rejecting it.`,
-        metadata: { callee: row.callee, exportName: row.exportName, file: row.file, limitName: row.limitName, line: row.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Fail-open rate-limit / CAPTCHA guard on a sensitive procedure"
-};
-
-export { ratelimitMiddlewareFailOpen as default };

package/dist/packem_shared/relationReferencesUnknownField-CjbLScJ1.mjs

@@ -1,54 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-BySnKhVB.mjs';
-
-const missingColumns = (byName, columnsOf, holder, relation) => {
-  const target = byName.get(relation.table);
-  if (!target) {
-    return [];
-  }
-  const fkTable = relation.kind === "one" ? holder : target;
-  const referencedTable = relation.kind === "one" ? target : holder;
-  const problems = [];
-  if (!columnsOf(fkTable).has(relation.field)) {
-    problems.push({ column: relation.field, owner: fkTable.name, side: "field" });
-  }
-  if (!columnsOf(referencedTable).has(relation.references)) {
-    problems.push({ column: relation.references, owner: referencedTable.name, side: "references" });
-  }
-  return problems;
-};
-const relationReferencesUnknownField = {
-  categories: ["SCHEMA"],
-  description: "A relation references a foreign-key or referenced column that is not declared on its table, so the join can never resolve.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "relation_references_unknown_field",
-  remediation: "Fix the `field` / `references` column name in the relation, or add the missing column.",
-  run: (context) => {
-    const byName = new Map(context.schema.tables.map((table) => [table.name, table]));
-    const columnsCache = /* @__PURE__ */ new Map();
-    const columnsOf = (table) => {
-      let columns = columnsCache.get(table);
-      if (!columns) {
-        columns = tableColumnSet(table);
-        columnsCache.set(table, columns);
-      }
-      return columns;
-    };
-    return context.schema.tables.flatMap(
-      (table) => table.relations.flatMap(
-        (relation) => missingColumns(byName, columnsOf, table, relation).map(
-          (problem) => emit(relationReferencesUnknownField, {
-            cacheKey: `relation_references_unknown_field:${table.name}:${relation.name}:${problem.side}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" uses ${problem.side} "${problem.column}", which is not declared on table "${problem.owner}".`,
-            metadata: { column: problem.column, owner: problem.owner, relation: relation.name, side: problem.side, table: table.name }
-          })
-        )
-      )
-    );
-  },
-  source: "static",
-  title: "Relation references unknown field"
-};
-
-export { relationReferencesUnknownField as default };

package/dist/packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs

@@ -1,33 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const relationReferencesUnknownTable = {
-  categories: ["SCHEMA"],
-  description: "A relation targets a table that does not exist in the schema. The relation can never load — the target is a typo or a removed/renamed table.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "relation_references_unknown_table",
-  remediation: "Fix the target table name in the relation, or add the missing table to the schema.",
-  run: (context) => {
-    const findings = [];
-    const tableNames = new Set(context.schema.tables.map((table) => table.name));
-    for (const table of context.schema.tables) {
-      for (const relation of table.relations) {
-        if (tableNames.has(relation.table)) {
-          continue;
-        }
-        findings.push(
-          emit(relationReferencesUnknownTable, {
-            cacheKey: `relation_references_unknown_table:${table.name}:${relation.name}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" targets table "${relation.table}", which does not exist in the schema.`,
-            metadata: { relation: relation.name, table: table.name, target: relation.table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Relation references unknown table"
-};
-
-export { relationReferencesUnknownTable as default };

package/dist/packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs

@@ -1,56 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const rlsUncoveredTable = {
-  categories: ["SECURITY"],
-  description: "A public procedure reads or writes a table that is covered by an RLS policy elsewhere in the app, but this procedure's builder chain does not include `.use(rls(...))`. The raw, unwrapped `ctx.db` silently bypasses every policy in the list.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "rls_uncovered_table",
-  remediation: "Add `.use(rls(policies))` to the procedure's builder chain — e.g. `c.use(rls(myPolicies)).query(...)` — so its `ctx.db` is wrapped by the same policy evaluator as the rest of the app. If this procedure is intentionally privileged (e.g. a background job), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
-  // eslint-disable-next-line sonarjs/cognitive-complexity -- the policy/table cross-reference is clearest as one linear pass; splitting it would obscure the flow.
-  run: (context) => {
-    if (context.rlsProcedures === void 0) {
-      return [];
-    }
-    const policyCoveredTables = /* @__PURE__ */ new Set();
-    for (const procedure of context.rlsProcedures) {
-      for (const table of procedure.rlsTables) {
-        if (table !== "") {
-          policyCoveredTables.add(table);
-        }
-      }
-    }
-    if (policyCoveredTables.size === 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.rlsProcedures) {
-      if (procedure.usesRls) {
-        continue;
-      }
-      if (procedure.visibility === "internal") {
-        continue;
-      }
-      const touched = /* @__PURE__ */ new Set();
-      for (const table of [...procedure.tablesRead, ...procedure.tablesWritten]) {
-        if (table !== "" && policyCoveredTables.has(table)) {
-          touched.add(table);
-        }
-      }
-      for (const table of touched) {
-        findings.push(
-          emit(rlsUncoveredTable, {
-            cacheKey: `rls_uncovered_table:${procedure.file}:${procedure.exportName}:${table}`,
-            detail: `\`${procedure.exportName}\` in ${procedure.file} accesses table \`${table}\` without \`.use(rls(...))\` — the table is policy-gated elsewhere in the app but this procedure bypasses those policies entirely.`,
-            metadata: { exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "RLS-gated table accessed without rls() middleware"
-};
-
-export { rlsUncoveredTable as default };

package/dist/packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const shapeTargetsGlobalTable = {
-  categories: ["PERFORMANCE"],
-  description: "A `defineShape` replicates from a `.global()` table. Global tables live outside the shard DO's SQLite op-log, so the shape is served through the cross-shard tier — coordinator/poll-refreshed and latency-tiered, not poke-live like a sharded shape.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "shape_targets_global_table",
-  remediation: "Expected if you want the cross-shard tier — just don't assume poke-live freshness; global shapes refresh on a poll. For live updates, replicate from a sharded table instead (denormalize the columns you need into the shard).",
-  run: (context) => {
-    if (context.shapes === void 0) {
-      return [];
-    }
-    const globalTables = new Set(context.schema.tables.filter((table) => table.shardKind === "global").map((table) => table.name));
-    const findings = [];
-    for (const shape of context.shapes) {
-      if (shape.table === void 0 || !globalTables.has(shape.table)) {
-        continue;
-      }
-      findings.push(
-        emit(shapeTargetsGlobalTable, {
-          cacheKey: `shape_targets_global_table:${shape.exportName}`,
-          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from the \`.global()\` table \`${shape.table}\`. It is served through the cross-shard global tier — poll-refreshed and latency-tiered, not poke-live.`,
-          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Shape replicates from a global (cross-shard) table"
-};
-
-export { shapeTargetsGlobalTable as default };

package/dist/packem_shared/shapeUnknownTable-C8aDWFoe.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const shapeUnknownTable = {
-  categories: ["SCHEMA"],
-  description: "A `defineShape` is bound to a `table` name that does not exist in the schema. The shape can never resolve a rowset — its subscription seeds empty and errors at the first flush.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "shape_unknown_table",
-  remediation: "Fix the shape's `table` to a real table name (check for a typo or a table that was renamed/removed).",
-  run: (context) => {
-    if (context.shapes === void 0) {
-      return [];
-    }
-    const knownTables = new Set(context.schema.tables.map((table) => table.name));
-    const findings = [];
-    for (const shape of context.shapes) {
-      if (shape.table === void 0 || knownTables.has(shape.table)) {
-        continue;
-      }
-      findings.push(
-        emit(shapeUnknownTable, {
-          cacheKey: `shape_unknown_table:${shape.exportName}`,
-          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from table \`${shape.table}\`, which is not declared in the schema. The shape can never resolve a rowset.`,
-          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Shape bound to an unknown table"
-};
-
-export { shapeUnknownTable as default };

package/dist/packem_shared/signupMutationWithoutDisposableGating-Dnbol2CS.mjs

@@ -1,39 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { i as isPublicWrite } from './helpers-BySnKhVB.mjs';
-
-const signupMutationWithoutDisposableGating = {
-  categories: ["SECURITY"],
-  description: "A public `mutation`/`action` that creates a user/session/account row has no disposable-email gate. Throwaway mailboxes farm free trials, evade bans, and pollute the user table.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "signup_mutation_without_disposable_gating",
-  remediation: "Add `.use(emailGateMiddleware({ email: (ctx) => ctx.args.email }))` from `@lunora/auth/email-guard` to reject disposable domains at signup, or gate better-auth's native signup with `withEmailGate(...)` / `emailGateDatabaseHooks(...)`.",
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.procedureProtections) {
-      if (!isPublicWrite(procedure) || !procedure.writesUserTable || procedure.usesEmailGate) {
-        continue;
-      }
-      findings.push(
-        emit(signupMutationWithoutDisposableGating, {
-          cacheKey: `signup_mutation_without_disposable_gating:${procedure.file}:${procedure.exportName}`,
-          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) writes a user/session/account table but has no disposable-email gate. Add \`.use(emailGateMiddleware(...))\` from \`@lunora/auth/email-guard\`.`,
-          metadata: {
-            exportName: procedure.exportName,
-            file: procedure.file,
-            kind: procedure.kind,
-            writesUserTable: procedure.writesUserTable
-          }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Account-creating write without a disposable-email gate"
-};
-
-export { signupMutationWithoutDisposableGating as default };

package/dist/packem_shared/softDeleteIncludeDeletedFromArgs-BLqDKrkM.mjs

@@ -1,38 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const softDeleteIncludeDeletedFromArgs = {
-  categories: ["SECURITY"],
-  description: "A `.public()` read passes `includeDeleted` (hardcoded `true` or derived from `args`) on a `.softDelete()` table, resurfacing soft-deleted rows to callers that should never see them.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "soft_delete_include_deleted_from_args",
-  remediation: "Drop `includeDeleted` from the public read so soft-deleted rows stay hidden, or move the trash/restore view behind an internal (or RLS/role-gated) procedure. Never wire `includeDeleted` from `args` on a public read — an attacker can set it to see rows the app treats as deleted.",
-  run: (context) => {
-    if (context.softDeleteReads === void 0) {
-      return [];
-    }
-    const softDeleteTables = new Set(context.schema.tables.filter((table) => table.softDelete !== void 0).map((table) => table.name));
-    if (softDeleteTables.size === 0) {
-      return [];
-    }
-    return context.softDeleteReads.filter((row) => row.visibility === "public" && row.table !== "" && softDeleteTables.has(row.table) && (row.hardcodedTrue || row.fromArgs)).map((row) => {
-      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
-      const detail = row.fromArgs ? `The public read in ${location} wires \`includeDeleted\` from request \`args\` on soft-delete table \`${row.table}\`, letting any caller resurface soft-deleted rows the app treats as gone.` : `The public read in ${location} hardcodes \`includeDeleted: true\` on soft-delete table \`${row.table}\`, returning soft-deleted rows to every caller.`;
-      return emit(softDeleteIncludeDeletedFromArgs, {
-        cacheKey: `soft_delete_include_deleted_from_args:${row.file}:${row.line.toString()}:${row.table}`,
-        detail,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          line: row.line,
-          source: row.fromArgs ? "args" : "literal",
-          table: row.table
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Soft-deleted rows resurfaced via includeDeleted on a public read"
-};
-
-export { softDeleteIncludeDeletedFromArgs as default };